You all can stop with the "HoW I UsE ClAuDe" articles.
Remote
Crankysec
@32x33@mastodon.sprawl.club
mastodon
4.6.6
A Crankysec PsyOp.
167
Followers
156
Following
45
Posts
Joined October 07, 2024
Crankysec:
Posts
LOL. This bitch sold out, got the bag, and is now complaining that the mega corp that paid him a lot of money doesn't give a shit about the work. Get bent. https://www.natesilver.net/p/disney-erased-fivethirtyeight
Who would've guessed that good software development practices were useful.
https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability
@willb@infosec.exchange fr. It's one thing to let it write some stupid slide deck, or some code that will have to go through several checks (I hope) before being deployed. Going "here's the filesystem, make yourself at home. Highly sensitive credentials are over there." is a whole other game.
Replying to
@32x33@mastodon.sprawl.club
@da_667@infosec.exchange Which, coincidentally, is a very neat trick if you want to rein in some dumb AI agent that just LOVES to pip install shit left and right to parse a fucking JSON.
"No, Claudio. There is no Python or PIP available to you. If you want to run any python, you can have a disposable dev shell. Stop trying to install shit."
Replying to
@da_667@infosec.exchange
@da_667@infosec.exchange I'm with you, brother. Fuck macOS. It was good 15 years ago, but that's no longer the case.
(but really, the best way to wrangle python is with a nix dev shell lol)
The circlejerk: "Terrible Signal exploit fixed thanks to journalists! FBI could read your deleted Signal messages!"
Me: Yikes. Let's look at the CVE.
The CVE: 6.2 Medium. Notifications marked for deletion could be unexpectedly retained on the device.
Notifications. Could.
Me: Zzzzzzz
@da_667@infosec.exchange "Pay twice for the privilege of watching ads!"
@da_667@infosec.exchange I mean, I get it. You put in the work, you should be compensated if you so choose. But, man... it's getting ridiculous. Next thing you know you'll have a "Want to @ me? That would be $5, please and thank you. Or purchase a subscription so you can watch ads when you purchase a membership to see sponsored content!"
Everyone's talking about how good Anthropic's products are at finding vulnerabilities, but no one is looking at how good they are at BEING the vulnerability.
(Apologies for linking to this shithole)
Replying to
@32x33@mastodon.sprawl.club
Can't have this post get more attention than the post that's straight from the source. Go follow the author of this beaut, please: @flyingpenguin@infosec.exchange
Replying to
@32x33@mastodon.sprawl.club
The more I read, the more annoyed I get. Which is good, given that I am CRANKYSEC. But, holy hell, man... Every single company associated with this bullshit, and every #cybersecurity org that tries to capitalize on this (*cough* CSA *cough* SANS *cough* OWASP) are making it *really* clear where they stand. They stand with the money. This is not for the benefit of the industry and its practitioners. This is for the benefit of sales. My company doesn't do that.
Replying to
@32x33@mastodon.sprawl.club
Anyhoo, the lesson here seems to be well-known: big company is full of shit, fanboys with no domain expertise post stupid shit about it, the press slobbers all over it, and your #cybersecurity program gets a budget cut because your boss thinks Mythos can do your job.
Replying to
@Viss@mastodon.social
@Viss@mastodon.social "Just disable every security feature and put the system in a state where this shit would probably happen naturally without any intervention whatsoever, call it a 0day, and tell everyone this thing's too damn powerful. The media loves this stuff!" Anthropic, probably.
Replying to
@32x33@mastodon.sprawl.club
This passage is all you need, really.
The Firefox test is not Firefox. It’s a SpiderMonkey JavaScript engine shell in a container, with “a testing harness mimicking a Firefox 147 content process, but without the browser’s process sandbox and other defense-in-depth mitigations.” (page 50)
Replying to
@32x33@mastodon.sprawl.club
Not to toot (natch!) my own horn here, but... Kinda like this: https://crankysec.com/blog/smash/
Replying to
@TallSimon@mstdn.ca
@TallSimon@mstdn.ca I'm sure you can implement this with 5 lines of Perl in 1998.
Replying to
@32x33@mastodon.sprawl.club
How about using this here thing from the same Kagi: https://kagi.com/smallweb
"Apple quietly launches AirPods Max 2" If you know me, you know that my OG AirPods Max stopped working out of nowhere (quite possibly a bad software update). It wouldn't even factory reset.
The geniuses at the bar told me that it would be $200 just to send it in for diagnostic. I told them to kindly fuck off, and bought a Nothing Tech CMF that was on sale for 60 bucks.
AirPods Max miraculously came back to life after sitting in a box for a couple of months.
But also, kind of alarming that a whole bunch of posts about "prompt engineering", "How I use LLMs", "My AI workflow" boil down to "know how to put your thoughts into written words with clarity".
Tech people are discovering that functional illiteracy is bad.
What we're seeing in tech today (and I use "today" very loosely here) is that feeling a lot of us in #cybersecurity feel when we go to a conference or something: Yes, we have this ONE thing in common, but I would avoid you like the plague in any other situation.
Believing that we all share the same values just because we share some niche interest is a bad idea. "We're all passionate about tech!" Sure, but you're also an asshole.
Little something for you beauts. My treat. https://defector.com/vindicated-at-last-in-my-years-long-loathing-of-grammarly?giftLink=21b3a668f2e4f6145592081f9caa17b0
When I said we should all have Gemini pods, you didn't listen. There's a sprawling greenfield right there for you to build on.
No, silly. This Gemini: https://en.wikipedia.org/wiki/Gemini_%28protocol%29
Apple can release a MacBook NeoTrinityMorpheus with the A87 Ultra Max Apple Silicon for $20 and it would still be a piece of shit because of macOS. No matter what John Gruber says.
LOL. This fucking take: https://yagmin.com/blog/your-docs-directory-is-doomed
LLMs suffer from document discoverability issues? They get confused about document ownership and domain expertise? Can't handle doc rot?
Welcome to the real world, buddy! If you're so smart, figure it out. What's that? I need to do ALL that meta-work just so you can perform according to what was promised? Get fucked.
Just a little something for the #cybersecurity and/or Robert De Niro fans!
PoC || GTFO. "Claude Opus 4.6 found more high-severity bugs in Firefox over a two-week period than the rest of the world typically reports in two months. The model discovered more than 100 bugs in total, 14 that were tagged as high severity. The model was asked to write code to exploit the bugs, but it turns out the model is much better at finding bugs than exploiting them. The exploits that Claude wrote would have been stopped in the real world by Firefox's other security mechanisms."
To all the young hockey players out there who are discovering things like “grep”, “gzip”, “tee”, pipes, “rsync”, and whatnot: you’re going to like this book.
https://www.oreilly.com/library/view/unix-power-tools/0596003307/